@withbuddi/buddi 0.1.0-pre.36 → 0.1.0-pre.37

package/node_modules/pino/docs/browser.md

@@ -7,6 +7,69 @@ This can be useful with isomorphic/universal JavaScript code.
 By default, in the browser,
 `pino` uses corresponding [Log4j](https://en.wikipedia.org/wiki/Log4j) `console` methods (`console.error`, `console.warn`, `console.info`, `console.debug`, `console.trace`) and uses `console.error` for any `fatal` level logs.
 
+<a id="nodejs-only-apis"></a>
+## Node.js-only APIs
+
+The browser build (`browser.js`, selected through the `browser` field in
+`package.json`) does not implement the parts of the API that depend on the file
+system or on worker threads. Accessing them in the browser throws a
+`TypeError`, because the export is simply absent:
+
+```js
+const pino = require('pino')
+pino.destination('./my-file') // TypeError: pino.destination is not a function
+```
+
+The following statics are available in Node.js only:
+
+| Static | Why it is Node.js only |
+| --- | --- |
+| [`pino.destination()`](/docs/api.md#pino-destination) | Returns a [`SonicBoom`](https://github.com/pinojs/sonic-boom) instance writing to a file descriptor. |
+| [`pino.transport()`](/docs/api.md#pino-transport) | Runs a [transport](/docs/transports.md) on a worker thread. |
+| [`pino.multistream()`](/docs/api.md#pino-multistream) | Fans out to multiple destination streams. |
+
+`pino.levels`, `pino.stdSerializers` and `pino.stdTimeFunctions` are available in
+both environments.
+
+### Methods that are no-ops in the browser
+
+These exist on a browser logger, so calling them is safe, but they do nothing:
+
+* [`logger.flush([cb])`](/docs/api.md#flush) — there is no write buffer
+  to flush. Note that a callback passed to it is **not** invoked.
+* Every `EventEmitter` method (`on`, `once`, `emit`, `removeListener`,
+  `listeners`, ...). As a consequence the
+  [`level-change`](/docs/api.md#level-change) event never fires in the
+  browser.
+
+### Writing isomorphic code
+
+Code shared between a server and a browser bundle should not call the Node.js
+only statics unconditionally. Guard the call rather than the environment, so the
+same branch works under any bundler:
+
+```js
+const pino = require('pino')
+
+const logger = pino.destination
+  ? pino(pino.destination('./my-file')) // Node.js
+  : pino({ browser: { asObject: true } }) // browser
+```
+
+Note that the browser build's `pino()` accepts the options object only. A second
+`destination` argument is accepted but ignored, so a logger constructed with one
+still writes to the console rather than failing:
+
+```js
+// in the browser the second argument is ignored, not honoured
+const logger = pino({ level: 'info' }, someDestination)
+logger.info('still goes to the console')
+```
+
+Assigning a no-op shim onto the `pino` export (`pino.destination = () => {}`)
+works too, but it mutates a module object shared with every other importer in the
+bundle; guarding the call site keeps the change local.
+
 ## Options
 
 Pino can be passed a `browser` object in the options object,

package/node_modules/pino/docs/child-loggers.md

@@ -20,6 +20,26 @@ module.exports = {
 }
 ```
 
+Child logger bindings are top-level fields on every log line emitted by the
+child logger. Do not create child loggers from externally supplied objects or
+user-controlled binding names, because those keys can conflict with Pino fields
+such as `level`, `time`, or `msg`, as well as application or security fields.
+If untrusted data must be associated with logs, place it under an
+application-controlled key:
+
+```js
+// Avoid: user-controlled keys become top-level fields on every child log line
+const child = logger.child(untrustedObject)
+
+// Prefer: user-controlled keys are contained under a trusted namespace
+const child = logger.child({ untrusted: untrustedObject })
+```
+
+As a matter of good security hygiene, prefer not to log untrusted data at all
+unless it is necessary. When it is necessary, sanitize and redact it first.
+See also [`logger.child()` in the API documentation](/docs/api.md#child) and
+[`mergingObject`](/docs/api.md#mergingobject).
+
 ## Cost of child logging
 
 Child logger creation is fast:
@@ -88,7 +108,8 @@ behavior.
 
 There may be cases where this edge case becomes problematic if a JSON parser with alternative behavior
 is used to process the logs. It's recommended to be conscious of namespace conflicts with child loggers,
-in light of an expected log processing approach.
+in light of an expected log processing approach. This is especially important for untrusted data: do not
+allow externally supplied objects or user-controlled key names to become child logger bindings.
 
 One of Pino's performance tricks is to avoid building objects and stringifying
 them, so we're building strings instead. This is why duplicate keys between

package/node_modules/pino/docs/ecosystem.md

@@ -71,6 +71,7 @@ according to a given format string.
 
 + [`@google-cloud/pino-logging-gcp-config`](https://www.npmjs.com/package/@google-cloud/pino-logging-gcp-config): Config helper and formatter to output [Google Cloud Platform Structured Logging](https://cloud.google.com/logging/docs/structured-logging)
 + [`@newrelic/pino-enricher`](https://github.com/newrelic/newrelic-node-log-extensions/blob/main/packages/pino-log-enricher): a log customization to add New Relic context to use [Logs In Context](https://docs.newrelic.com/docs/logs/logs-context/logs-in-context/)
++ [`@sentry/node`](https://docs.sentry.io/platforms/javascript/guides/node/configuration/integrations/pino/): Sentry SDK with native pinoIntegration for direct Pino instrumentation and error tracking.
 + [`cloud-pine`](https://github.com/metcoder95/cloud-pine): transport that provides abstraction and compatibility with [`@google-cloud/logging`](https://www.npmjs.com/package/@google-cloud/logging).
 + [`cls-proxify`](https://github.com/keenondrums/cls-proxify): integration of pino and [CLS](https://github.com/jeff-lewis/cls-hooked). Useful for creating dynamically configured child loggers (e.g. with added trace ID) for each request.
 + [`crawlee-pino`](https://github.com/imyelo/crawlee-pino): use Pino to log within Crawlee

package/node_modules/pino/docs/help.md

@@ -147,11 +147,19 @@ const logger = pino({
 <a id="dupe-keys"></a>
 ## How Pino handles duplicate keys
 
-Duplicate keys are possibly when a child logger logs an object with a key that
-collides with a key in the child loggers bindings.
+Duplicate keys are possible when a logged object contains a top-level key that
+collides with a Pino field or a key in the child logger's bindings, or when child
+logger bindings collide with parent bindings.
+
+For untrusted data, avoid passing externally supplied objects directly to logging
+methods or child logger bindings. User-controlled top-level keys can conflict
+with Pino fields such as `level`, `time`, or `msg`, as well as application or
+security fields. If untrusted data must be logged, place it under an
+application-controlled key, such as `logger.info({ untrusted })`, and prefer not
+to log untrusted data at all unless necessary.
 
 See the [child logger duplicate keys caveat](/docs/child-loggers.md#duplicate-keys-caveat)
-for information on this is handled.
+and [`logger.child()` bindings](/docs/api.md#logger-child-bindings) for more information.
 
 <a id="level-string"></a>
 ## Log levels as labels instead of numbers

package/node_modules/pino/docs/lts.md

@@ -37,6 +37,35 @@ A "month" is defined as 30 consecutive days.
 
 [semver]: https://semver.org/
 
+<a name="supported-nodejs"></a>
+
+### Supported Node.js versions
+
+Pino follows the [Node.js release schedule][node-release]. A Pino release line
+is tested against, and supports, every Node.js release line that is in its
+_current_, _active LTS_, or _maintenance LTS_ phase when the Pino line is
+released, as described above.
+
+Support for a Node.js version is **only dropped in a new Pino major release**. A
+published Pino major will never drop a Node.js release line that it originally
+shipped with, so upgrading within a major line (for example, from `9.1.0` to
+`9.4.0`) will never remove support for a Node.js version you already run on.
+
+Once a Node.js release line reaches its end-of-life, Pino supports it on a
+best-effort basis, with the following caveats:
+
+- End-of-life Node.js versions are not exercised in continuous integration.
+- Some fixes and features cannot be backported to the Pino lines that still
+  support them.
+- Dependencies cannot be kept up to date.
+
+To keep running on an end-of-life Node.js version, pin your dependency to the
+last Pino major line that supported it. The [Schedule](#lts-schedule) below maps
+each Pino release line to the Node.js versions it supports; for example, to stay
+on Node.js 14, install the latest `8.x` release with `"pino": "8.x"`.
+
+[node-release]: https://github.com/nodejs/release#release-schedule
+
 <a name="lts-schedule"></a>
 
 ### Schedule

package/node_modules/pino/docs/pretty.md

@@ -32,4 +32,7 @@ module like [`pino-pretty`][pp]:
   logger.info('hi')
   ```
 
+**Note:** `logger.flush()` does not flush the output of `pino-pretty`. See
+[Flush Limitations with `pino-pretty`](/docs/asynchronous.md) for more details.
+
   [pp]: https://github.com/pinojs/pino-pretty

package/node_modules/pino/docs/redaction.md

@@ -1,14 +1,11 @@
 # Redaction
 
-> Redaction is not supported in the browser [#670](https://github.com/pinojs/pino/issues/670)
-
 To redact sensitive information, supply paths to keys that hold sensitive data
 using the `redact` option. Note that paths that contain hyphens need to use
 brackets to access the hyphenated property:
 
 ```js
-const logger = require('.')({
-  redact: ['key', 'path.to.key', 'stuff.thats[*].secret', 'path["with-hyphen"]']
+const logger = require('.')({\n  redact: ['key', 'path.to.key', 'stuff.thats[*].secret', 'path["with-hyphen"]']
 })
 
 logger.info({
@@ -37,8 +34,7 @@ an object. This allows control over *how* information is redacted.
 For instance, setting the censor:
 
 ```js
-const logger = require('.')({
-  redact: {
+const logger = require('.')({\n  redact: {
     paths: ['key', 'path.to.key', 'stuff.thats[*].secret'],
     censor: '**GDPR COMPLIANT**'
   }
@@ -67,8 +63,7 @@ This will output:
 The `redact.remove` option also allows for the key and value to be removed from output:
 
 ```js
-const logger = require('.')({
-  redact: {
+const logger = require('.')({\n  redact: {
     paths: ['key', 'path.to.key', 'stuff.thats[*].secret'],
     remove: true
   }

package/node_modules/pino/docs/transports.md

@@ -159,6 +159,36 @@ const transport = pino.transport({
 pino(transport)
 ```
 
+#### `formatters.level` with multiple targets
+
+When using `targets`, Pino routes records in the worker thread based on the numeric `level` field in each log line. Because of that, a custom `formatters.level` must not remove, rename, or convert `level` to a string when multiple targets are configured.
+
+Unsupported example:
+
+```js
+const logger = pino({
+  formatters: {
+    level (label) {
+      return { severity: label }
+    }
+  },
+  transport: {
+    targets: [
+      { target: 'pino/file', options: { destination: 1 } },
+      { target: 'pino/file', options: { destination: 2 } }
+    ]
+  }
+})
+```
+
+In this case, Pino cannot apply per-target level filtering correctly. Depending on how the transport is constructed, Pino will either throw or emit a warning.
+
+Supported alternatives:
+
+- Keep the numeric `level` field unchanged when using multiple targets.
+- If you need string labels such as `"info"`, transform the output in a transport pipeline or in a custom transport after routing has already happened.
+- `timestamp` customization still works with multiple targets.
+
 It is also possible to use the `dedupe` option to send logs only to the stream with the higher level.
 ```js
 const pino = require('pino')
@@ -554,6 +584,7 @@ PRs to this document are welcome for any new transports!
 + [pino-roll](#pino-roll)
 + [pino-seq-transport](#pino-seq-transport)
 + [pino-sentry-transport](#pino-sentry-transport)
++ [Sentry Native SDK Integration](#sentry-native-integration)
 + [pino-slack-webhook](#pino-slack-webhook)
 + [pino-telegram-webhook](#pino-telegram-webhook)
 + [pino-yc-transport](#pino-yc-transport)
@@ -1168,6 +1199,46 @@ pino(transport)
 [pino-sentry-transport]: https://github.com/tomer-yechiel/pino-sentry-transport
 [Sentry]: https://sentry.io/
 
+<a id="sentry-native-integration"></a>
+### Sentry Native SDK Integration
+
+As an alternative to using a Pino transport, Sentry's Node.js SDK (v10.18.0+) provides a native `pinoIntegration` that instruments Pino directly. This approach captures logs within the Sentry SDK rather than forwarding them through a separate worker process.
+
+```js
+const Sentry = require('@sentry/node')
+const pino = require('pino')
+
+Sentry.init({
+  dsn: 'https://******@sentry.io/12345',
+  enableLogs: true,
+  integrations: [Sentry.pinoIntegration()],
+})
+
+const logger = pino()
+logger.info('This log will be captured by Sentry')
+```
+
+The integration supports configuring which log levels are captured as Sentry logs or errors:
+
+```js
+Sentry.init({
+  dsn: 'https://******@sentry.io/12345',
+  enableLogs: true,
+  integrations: [
+    Sentry.pinoIntegration({
+      // Capture these levels as Sentry logs
+      log: { levels: ['info', 'warn', 'error'] },
+      // Capture these levels as Sentry errors
+      error: { levels: ['error', 'fatal'], handled: true }
+    })
+  ],
+})
+```
+
+**Note:** This integration only works in the Node.js runtime. Requires Sentry SDK version 10.18.0 or higher and pino version 8.0.0 or higher. For full documentation, see the [Sentry Pino integration docs][sentry-pino-docs].
+
+[sentry-pino-docs]: https://docs.sentry.io/platforms/javascript/guides/node/configuration/integrations/pino/
+
 <a id="pino-seq"></a>
 ### pino-seq
 

package/node_modules/pino/docs/web.md

@@ -274,28 +274,25 @@ See the [pino-http README](https://npm.im/pino-http) for more info.
 ## Pino with Hono
 
 ```sh
-npm install pino pino-http hono
+npm install pino @hono/structured-logger hono
 ```
 
 ```js
 import { serve } from '@hono/node-server';
 import { Hono } from 'hono';
 import { requestId } from 'hono/request-id';
-import { pinoHttp } from 'pino-http';
+import { structuredLogger } from '@hono/structured-logger';
+import pino from 'pino';
+
+const rootLogger = pino();
 
 const app = new Hono();
 app.use(requestId());
-app.use(async (c, next) => {
-  // pass hono's request-id to pino-http
-  c.env.incoming.id = c.var.requestId;
-
-  // map express style middleware to hono
-  await new Promise((resolve) => pinoHttp()(c.env.incoming, c.env.outgoing, () => resolve()));
-
-  c.set('logger', c.env.incoming.log);
-
-  await next();
-});
+app.use(
+  structuredLogger({
+    createLogger: (c) => rootLogger.child({ requestId: c.var.requestId }),
+  })
+);
 
 app.get('/', (c) => {
   c.var.logger.info('something');
@@ -306,4 +303,4 @@ app.get('/', (c) => {
 serve(app);
 ```
 
-See the [pino-http README](https://npm.im/pino-http) for more info.
+See the [@hono/structured-logger README](https://github.com/honojs/middleware/blob/main/packages/structured-logger/README.md) for more info.

package/node_modules/pino/eslint.config.js

@@ -8,21 +8,29 @@ module.exports = defineConfig([
     ts: true
   }),
   globalIgnores([
-    'pino.d.ts',
     'test/fixtures/syntax-error-esm.mjs',
-    'test/fixtures/ts/*cjs',
+    'test/fixtures/ts/*cjs'
   ]),
   {
     rules: {
-      'no-var': 'off',
-    },
+      'comma-dangle': ['error', 'never'],
+      'no-var': 'off'
+    }
+  },
+  {
+    files: ['pino.d.ts'],
+    rules: {
+      '@typescript-eslint/no-use-before-define': 'off',
+      '@typescript-eslint/no-unused-vars': 'off'
+    }
   },
   {
     files: ['test/types/**/*'],
     rules: {
+      'no-unused-expressions': 'off',
       '@typescript-eslint/no-unused-expressions': 'off',
       '@typescript-eslint/no-unused-vars': 'off',
-      'n/handle-callback-err': 'off',
-    },
-  },
+      'n/handle-callback-err': 'off'
+    }
+  }
 ])

package/node_modules/pino/lib/caller.js

@@ -1,10 +1,20 @@
 'use strict'
 
+const util = require('node:util')
+
+// getCallSite requires Node >=22.9.0
+// getCallSite was renamed in Node 23.3.0 / 22.12.0
+const getCallSites = util.getCallSites ?? util.getCallSite
+
 function noOpPrepareStackTrace (_, stack) {
   return stack
 }
 
 module.exports = function getCallers () {
+  if (getCallSites) {
+    return getCallSites().slice(2).map(callSite => callSite.scriptName)
+  }
+
   const originalPrepare = Error.prepareStackTrace
   Error.prepareStackTrace = noOpPrepareStackTrace
   const stack = new Error().stack

package/node_modules/pino/lib/meta.js

@@ -1,3 +1,3 @@
 'use strict'
 
-module.exports = { version: '10.3.1' }
+module.exports = { version: '10.4.0' }

package/node_modules/pino/lib/multistream.js

@@ -48,7 +48,13 @@ function multistream (streamsArray, opts) {
   // we can exit early because the streams are ordered by level
   function write (data) {
     let dest
-    const level = this.lastLevel
+    // `lastLevel` is normally the numeric level, but a source may relay a
+    // level label string (e.g. pino-abstract-transport forwarding lines
+    // produced with a `formatters.level` option). Resolve it to a number so
+    // the level comparisons below don't silently drop the record.
+    const level = typeof this.lastLevel === 'string'
+      ? (this.streamLevels || streamLevels)[this.lastLevel]
+      : this.lastLevel
     const { streams } = this
     // for handling situation when several streams has the same level
     let recordedLevel = 0
@@ -99,7 +105,7 @@ function multistream (streamsArray, opts) {
 
   function add (dest) {
     if (!dest) {
-      return res
+      return this
     }
 
     // Check that dest implements either StreamEntry or DestinationStream
@@ -135,7 +141,7 @@ function multistream (streamsArray, opts) {
 
     this.minLevel = streams[0].level
 
-    return res
+    return this
   }
 
   function remove (id) {
@@ -148,7 +154,7 @@ function multistream (streamsArray, opts) {
       this.minLevel = streams.length > 0 ? streams[0].level : -1
     }
 
-    return res
+    return this
   }
 
   function end () {
@@ -174,12 +180,14 @@ function multistream (streamsArray, opts) {
       write,
       add,
       remove,
+      emit,
+      flushSync,
+      end,
       minLevel: level,
       streams,
       clone,
-      emit,
-      flushSync,
-      [metadata]: true
+      [metadata]: true,
+      streamLevels
     }
   }
 }

package/node_modules/pino/lib/redaction.js

@@ -64,14 +64,19 @@ function redaction (opts, serialize) {
 
     o[ns].push(nextPath)
     return o
-  }, {})
+    // The keys here are the first segment of each redact path, so they are the
+    // user's strings. On a plain object a path like 'constructor.secret' reads
+    // the inherited function, and `o[ns] = o[ns] || []` keeps it.
+  }, Object.create(null))
 
   // the redactor assigned to the format symbol key
   // provides top level redaction for instances where
   // an object is interpolated into the msg string
-  const result = {
+  // Same reason as the shape above: the keys come from the redact paths, and
+  // this object is later indexed with them by `asJson`.
+  const result = Object.assign(Object.create(null), {
     [redactFmtSym]: Redact({ paths, censor, serialize, strict, remove })
-  }
+  })
 
   const topCensor = (...args) => {
     return typeof censor === 'function' ? serialize(censor(...args)) : serialize(censor)

package/node_modules/pino/lib/symbols.js

@@ -38,6 +38,7 @@ const serializersSym = Symbol.for('pino.serializers')
 const formattersSym = Symbol.for('pino.formatters')
 const hooksSym = Symbol.for('pino.hooks')
 const needsMetadataGsym = Symbol.for('pino.metadata')
+const transportUsesMultistreamSym = Symbol.for('pino.transport.usesMultistream')
 
 module.exports = {
   setLevelSym,
@@ -70,5 +71,6 @@ module.exports = {
   hooksSym,
   nestedKeyStrSym,
   mixinMergeStrategySym,
-  msgPrefixSym
+  msgPrefixSym,
+  transportUsesMultistreamSym
 }

package/node_modules/pino/lib/tools.js

@@ -258,7 +258,7 @@ function asChindings (instance, bindings) {
       value = serializers[key] ? serializers[key](value) : value
       value = (stringifiers[key] || wildcardStringifier || stringify)(value, stringifySafe)
       if (value === undefined) continue
-      data += ',"' + key + '":' + value
+      data += ',' + asString(key) + ':' + value
     }
   }
   return data
@@ -349,7 +349,7 @@ function createArgsNormalizer (defaultOptions) {
       stream = transport({ caller, ...opts.transport, levels: customLevels })
     }
     opts = Object.assign({}, defaultOptions, opts)
-    opts.serializers = Object.assign({}, defaultOptions.serializers, opts.serializers)
+    opts.serializers = Object.assign(Object.create(null), defaultOptions.serializers, opts.serializers)
     opts.formatters = Object.assign({}, defaultOptions.formatters, opts.formatters)
 
     if (opts.prettyPrint) {

package/node_modules/pino/lib/transport.js

@@ -9,6 +9,8 @@ const sleep = require('atomic-sleep')
 const onExit = require('on-exit-leak-free')
 const ThreadStream = require('thread-stream')
 
+const { transportUsesMultistreamSym } = require('./symbols')
+
 function setupOnExit (stream) {
   // This is leak free, it does not leave event handlers
   onExit.register(stream, autoEnd)
@@ -194,6 +196,8 @@ function transport (fullOptions) {
     ...fullOptions.options
   }
 
+  let usesMultistream = false
+
   // Backwards compatibility
   const callers = typeof caller === 'string' ? [caller] : caller
 
@@ -228,6 +232,11 @@ function transport (fullOptions) {
         }
       })
     })
+
+    const targetsHaveLevel = options.targets.some(t => t.level != null)
+    const pipelinesHaveLevel = options.pipelines.some(p => p.some(t => t.level != null))
+    usesMultistream = options.targets.length + options.pipelines.length > 1 ||
+      targetsHaveLevel || pipelinesHaveLevel
   } else if (pipeline) {
     target = bundlerOverrides['pino-worker'] || join(__dirname, 'worker.js')
     options.pipelines = [pipeline.map((dest) => {
@@ -249,7 +258,11 @@ function transport (fullOptions) {
   options.pinoWillSendConfig = true
 
   const name = (targets || pipeline) ? 'pino.transport' : target
-  return buildStream(fixTarget(target), options, worker, sync, name)
+  const stream = buildStream(fixTarget(target), options, worker, sync, name)
+  if (usesMultistream) {
+    stream[transportUsesMultistreamSym] = true
+  }
+  return stream
 
   function fixTarget (origin) {
     origin = bundlerOverrides[origin] || origin

package/node_modules/pino/lib/worker.js

@@ -123,7 +123,10 @@ module.exports = async function ({ targets, pipelines, levels, dedupe }) {
   // OR
   //
   // pino.transport({ pipeline: ... })
-  if (targetStreams.length === 1) {
+  //
+  // When a `level` is set on the single target/pipeline, fall through to the
+  // multistream path so the per-target level filter is honored (#1996).
+  if (targetStreams.length === 1 && targetStreams[0].level == null) {
     return targetStreams[0].stream
   } else {
     return build(process, {